Ask Your Question

How do you choose a filter under capture?

asked 2021-11-18 19:51:02 +0000

I have started Wireshark. Under the Capture page, it asks to choose a filter. WHat filter should I choose?

edit retag flag offensive close merge delete


I am using Win10

tchuckc gravatar imagetchuckc ( 2021-11-18 19:52:37 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted

answered 2021-11-19 07:14:18 +0000

Guy Harris gravatar image

it asks to choose a filter

The Wireshark mai screen says "...using this filter", with the box for the filter saying "Enter a capture filter: ...".

The capture options dialog (Capture > Options) says "Capture filter for selected interfaces:", with the box for the filter again saying "Enter a capture filter: ...".

The key word here is "enter", not "choose". It's not as if Wireshark offers a limited set of filters from which you must choose one. It allows you to type in an arbitrary capture filter...

...including an empty filter, i.e. don't type anything in.

If you've already typed in filters and done captures with them, they will be remembered by Wireshark, and it will let you choose one of them from a drop-down menu. If you haven't, there won't be any from which to choose.

The capture filter controls which packets that arrive on the interfaces on which Wireshark is capturing will be seen by Wireshark; all the packets that match the filter expression will be seen by Wireshark, and the others will be discarded.

If the filter is empty, all packets will be seen.

The pcap-filter man pagedescribes the syntax of capture filters and what packets a filter matches. For example "host" matches all packets sent to or from

edit flag offensive delete link more

answered 2021-11-19 06:40:20 +0000

Jaap gravatar image

You don't _have_ to filter anything, so can leave it empty. _But_ if you want to limit what frames are captured from an interface you can add a capture filter expression. See here for more details.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-11-18 19:51:02 +0000

Seen: 386 times

Last updated: Nov 19 '21